How your clients' data is protected
A bookkeeping firm holds other people's books. ApexLedger is built around that responsibility. Here is exactly how.
- Canada only. The application, your company files and every backup stay in Canadian data centres.
- Encrypted. 256-bit AES on disk, TLS 1.2 or newer in transit, HTTPS only.
- Every firm is walled off. One database file per company inside one firm's folder — nothing is shared between firms.
- Named sign-ins. Own password or Microsoft account, lockout after eight failed attempts, and each seat reaches only its part of the application.
- Every change carries a name. A full Activity Log; posted entries are voided, never deleted.
- Backed up nightly. Kept 30 days with a second Canadian copy, and you can download any company file yourself.
- Never used against you. No AI training on your books, no tracking scripts, no selling or sharing of your data.
Where the data lives
Canada only
The application, every company file and every backup run in Canadian data centres, and the whole server is backed up separately every night, also in Canada. Nothing is stored or processed outside Canada.
Hosted and backed up in CanadaCertified data centres
ISO 27001, ISO 27017, ISO 27018, SOC 1, SOC 2 and SOC 3, and the Government of Canada's Protected B requirements.
Certified hostingEncrypted at rest
Company data and backups are encrypted on disk with 256-bit AES.
AES-256 at restEncrypted in transit
HTTPS with TLS 1.2 or newer, certificates that renew themselves, and HSTS — so an unencrypted connection is never attempted.
TLS 1.2+ · HSTSOne firm can never see another
One file per company, one folder per firm
Each client company is its own database file inside one firm's folder. No table of transactions is shared between firms, so there is no filter that could be wrong — the server refuses by path any request that reaches for another firm's folder.
Checked on every route before every releaseSessions are separate too
Every request runs in its own session with its own database connection, resolved from the sign-in cookie on the server — never from anything the browser sends.
Per-session connectionsWho can do what
Named sign-ins, no sharing
Each person has their own password, stored as a salted scrypt hash and never in clear, or signs in with Microsoft. Eight failed attempts lock the address out for fifteen minutes.
scrypt · lockout · Microsoft sign-inAccess follows the seat
Business, Payroll Unlimited, Bookkeeper and Full accountant seats each reach only their part of the application, enforced by the server on every request — a payroll clerk cannot read the ledger, whatever the screen shows.
Enforced on the server, not in the browserEvery change carries a name
The Activity Log records who did what and when. Posted entries are voided, never deleted; filed returns lock their period.
Full audit trailDownloads and uploads are checked
A download link works once, for the session that asked for it. Uploads must be genuine database files; documents are stored, never executed.
Single-use links · validated uploadsThe server and the network
| Firewall | Only HTTPS (TCP 443) is open to the internet. Administrative access comes from one address, by key, with no password. |
|---|---|
| Browser protections | A strict Content-Security-Policy on every response, with no framing and no sniffing. No inline scripts, and nothing loaded from third parties. |
| Backups | A nightly snapshot kept for 30 days, and the whole server is backed up separately every night, also in Canada. You can download a copy of any company file yourself at any time. |
| Monitoring | Availability is watched automatically; we are alerted if the server is unreachable for five minutes. |
| Updates | Updates are deployed to the server — nothing to install or patch, and nobody is signed out. |
What we do not do
- We do not move or process your data outside Canada.
- We do not use your books to train any AI. Voice recognition runs on the same Canadian server. The optional in-app assistant is switched off; it works only if we connect it to an outside AI service, and then only what is typed to the assistant goes to that service.
- We do not run analytics or tracking scripts on the application, and none on this website.
- We do not open a firm's company file except to support that firm at its request, and every such access is logged.
- We do not sell, share or aggregate customer data.
Your side of it
Keep sign-ins personal, deactivate people who leave (owners do this on the Administration page), use "Sign in with Microsoft" where your firm has two-step verification, and review what you file. The Subscription Agreement sets this out.